SEC555: SIEM with Tactical Analytics

I came to SEC555 to be introduced to high impact investigative techniques that will net the greatest return on investment for my SOC, and SANS delivered.

Conrad Bovell, CMS

Even on the first day, I have gained knowledge that will make my SIEM much more effective.

Tice Norman, CNHSA

Many organizations have logging capabilities but lack the people and processes to analyze it. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide individuals training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab heavy course that utilizes SOF-ELK, a SANS sponsored free SIEM solution, to train hands on experience and provide the mindset for large scale data analysis.

Today, security operations do not suffer from a "Big Data" problem but rather a "Data Analysis" problem. Let's face it, there are multiple ways to store and process large amounts of data without any real emphasis on gaining insight into the information collected. Added to that is the daunting idea of an infinite list of systems from which one could collect logs. It is easy to get lost in the perils of data saturation. This class is the switch from the typical churn and burn log systems, to achieving actionable intelligence and developing a tactical Security Operations Center (SOC).

This course is designed to demystify the Security Information and Event Management (SIEM) architecture and process, by navigating the student through the steps of tailoring and deploying a SIEM to full Security Operations Center (SOC) integration. The material will cover many bases in the "appropriate" use of a SIEM platform to enrich readily available log data in enterprise environments and extract actionable intelligence. Once collected, the student will be shown how to present the gathered input into useable formats to aid in eventual correlation. Students will then iterate through the log data and events to analyze key components that will allow them to learn how rich this information is, how to correlate the data, start investigating based on the aggregate data, and finally, how to go hunting with this newly gained knowledge. They will also learn how to deploy internal post-exploitation tripwires and breach canaries to nimbly detect sophisticated intrusions. Throughout the course, the text and labs will not only show how to manually perform these actions, but how to automate many of the processes mentioned so students may employ these tasks the day they return to the office.

The underlying theme is to actively apply Continuous Monitoring and analysis techniques by utilizing modern cyber threat attacks. Labs will involve replaying captured attack data to provide real world results and visualizations.

Course Syllabus

SEC555.1: SIEM Architecture

Overview

Logging and analysis is a critical component in cyber network defense and allows for both reactive and proactive detection of adversarial activities. When properly utilized it becomes the backbone for agile detection as well as provides understanding to the overall environment. Logging and analysis products and techniques have been around for many years and are quickly gaining more and more functionality. This section will introduce free logging and analysis tools and focus on techniques to make sense of and augment traditional logs. It also covers how to handle the big data problem of handling billions of logs and how advances in free tools are starting to give commercial solutions a run for their money.

Day one is designed to bring all students up to speed on SIEM concepts and to bring all students to a base level to carry them through the rest of the class. It is designed to also cover SIEM best practices. During day one we will be introducing Elasticsearch, Logstash, and Kibana within SOF-ELK (a VM co-maintained by Phil Hagen and Justin Henderson) and immediately go into labs to get students comfortable with ingesting, manipulating, and reporting on log data.

Exercises

SOF-ELK Orientation

Consuming logs using files or network ports

Finding ways to take "ordinary" logs and augment them to advanced detection capabilities

Develop visualizations and dashboards to find the adversary activity lurking within massive amounts of data

CPE/CMU Credits: 8

Topics

State of the SOC/SIEM

Industry statistics

Industry problems

Log Monitoring

Assets

Windows/Linux

Network devices

Security devices

Data gathering strategies

Pre-planning

Logging architecture

Log inconsistencies

Log collection and normalization

Log retention strategies

Correlation and gaining context

Reporting and analytics

Alerting

SIEM platforms

Commercial solutions

Home-grown solutions

Planning a SIEM

Ingestion control

What to collect

Mission

SIEM Architecture

Ingestion techniques and nodes

Acceptance and manipulation for value

Augmentation of logs for detection

Data queuing and resiliency

Storage and speed

Analytical reporting

Visualizations

Detection Dashboards

SEC555.2: Service Profiling with SIEM

Overview

A vast majority of network communication occurs over key network protocols and yet it is uncommon for organizations to use or collect this data. The sheer volume can be overwhelming. However, these common data sources provide an opportunity in identifying modern day attacks.

This section covers how to collect and handle this massive amount of data. Methods for collecting these logs through service logs such as from DNS servers will be covered as well as passive ways of pulling the same data from the network itself. Techniques will be demonstrated to augment and add valuable context to the data as it is collected.

Finally, analytical principles will be covered for finding the needles in the stack of needles. We will cover how even if we have the problem of searching through billions of logs that we can surface only meaningful items of interest. Active dashboards will be designed to quickly find the logs of interest and to provide analysts with additional context for what to do next.

Exercises

Operationalizing massive amounts of DNS logs

Detecting C2 and other HTTP attacks by analyzing HTTP data across the enterprise

Use adversary tactics against them using HTTPS logs and advanced analytic principles

Topics

Analyzing common application logs that generate tremendous amounts of data

DNS

Finding new domains being accessed

Pulling in addition information such as domain age

Finding randomly named domains

Discover domain shadowing techniques

Identifying recon

Find DNS C2 channels

HTTP

Use large datasets to find attacks

Identify bot traffic hiding in the clear

Discover requests that users do not make

Find ways to filter out legitimate noise

Use attacker randomness against them

Identify automated activity vs user activity

Filter approved web clients vs unauthorized

Find HTTP C2 channels

HTTPS

Alter information for large scale analysis

Analyze certificate fields to identify attack vectors

Track certificate validity

Apply techniques that overlap with standard HTTP

Find HTTPS C2 channels

SMTP

Identify where unauthorized email is coming from

Find compromised mail services

Fuzzy matching likely phishing domains

Data exfiltration detection

Apply threat intelligence to generic network logs

Active Dashboards and Visualizations

Correlate network datasets

Build frequency analysis tables

Establish network baseline activity

SEC555.3: Advanced Endpoint Analytics

Overview

The value in endpoint logs provides tremendous visibility in detecting attacks. Especially, in regards to finding post compromise activity, endpoint logs can quickly become second to none. However, logs even on a single desktop can range in the tens if not hundreds of thousand events per day. Multiply this by the number of systems in your environment and it is no surprise why organizations get overwhelmed.

This section will cover the how and more importantly the why behind collecting system logs. Various collection strategies and tools will be used to gain hands on experience and to provide simplification with handling and filtering the seemingly infinite amount of data generated by both servers and workstations.

Workstations log strategies will be covered in depth due to their value in today's modern attack vectors. After all, modern day attacks typically start and then spread from workstations.

Exercises

Filtering endpoint logs

Detect compromise using key Windows events

Identify internal pivoting activity using system logs

Detect post exploitation using command line logging

Apply long tail analysis to identify abnormal program usage

CPE/CMU Credits: 8

Topics

Endpoint logs

Understanding value

Methods of collection

Agents

Agentless

Scripting

Adding additional logging

EMET

Sysmon

Group Policy

Windows filtering and tuning

Analyze critical events based on attacker patterns

Finding signs of exploitation

Find signs of internal reconnaissance

Finding persistence

Privilege escalation

Establishing a foothold

Cleaning up tracks

Host-based firewall logs

Discover internal pivoting

Identify unauthorized listening executables

See scan activity

Credential theft and reuse

Multiple failed logons

Unauthorized account use

Monitor PowerShell

Configure PowerShell logging

Identify obfuscation

Identify modern attacks

SEC555.4: Baselining and User Behavior Monitoring

Overview

Know thyself is often quoted to defenders as a key defense strategy. And yet this one of the most difficult things to accomplish. Take something such as having a list of all assets in an organization and knowing if any non-company assets are on the network. The task sounds simple but ends up being incredibly difficult to maintain in today's ever evolving networks.

This section focuses on applying techniques to automatically maintain a list of assets and their configurations as well as methods to distinguish if they are authorized vs unauthorized. Key locations to provide high fidelity data will be covered and techniques to correlate and combine multiple sources of data together will be demonstrated to build a master inventory list.

Other forms of knowing thyself will be introduced such as gaining hands on experience in applying network and system baselining techniques. We will monitor network flows and identify abnormal activity such as C2 beaconing as well as look for unusual user activity.

Finally, we will apply large data analysis techniques to sift through massive amounts of endpoint data. This will be used to find things such as unwanted persistence mechanisms, dual-homed devices, and more.

SEC555.5: Tactical SIEM Detection and Post-Mortem Analysis

Overview

Multiple security devices exist but often are designed to be independent. Analysts are commonly divided into specialty areas and focus on their respective area such as a network intrusion detection system. However, alerts from a single security device lack context and are akin to the common analogy of "looking up from the bottom of a well".

This section focuses on combining multiple security logs for central analysis. More importantly we will cover methods for combining multiple sources to provide improved context to analysts. We will also show how providing context with asset data can help prioritize analyst time, saving money and addressing risks that matter.

After covering ways to optimize traditional security alerts we will jump into new methods to utilize logging technology to implement virtual tripwires. While it would be ideal to prevent attacker's from gaining access to your network it is a given that at some point you will be compromised. However, compromise is just the beginning and not the end goal. Adversaries will crawl your systems and network to achieve their own ends. Knowing this we will implement logging based tripwires that should a single one be "stepped on" we can quickly detect and respond to the adversary.

Exercises

Use security alerts with log context to identify real attacks

Establish security control effectiveness and monitor for unauthorized outbound connections

Correlate malware sandbox logs with other systems to identify victims across enterprise

Monitor Firewall Activity

Identify scanning activity on inbound denies

Apply auto response based on alerts

Find unexpected outbound traffic

Baseline allow/denies to identify unexpected changes

Apply techniques to filter out noise in denied traffic

SIEM tripwires

Configure systems to generate early log alerts after compromise

Identify file and folder scan activity

Identify user token stealing

Operationalize virtual honeypots with central logging

Allow phone home tracking

Post mortem analysis

Re-analyze network traffic

Identify malicious domains and IPs

Look for beaconing activity

Identify unusual time-based activity

Use threat intel to reassess previous data fields such as user-agents

Utilize hashes in log to constantly re-evaluate for known bad files

SEC555.6: Capstone: Design, Detect, Defend

Overview

The course culminates in a team-based design, detect, and defend the flag competition. Powered by NetWars, day six provides a full day of hands-on work applying the principles taught throughout the week.

Your team will progress through multiple levels and missions designed to ensure mastery of the modern cyber defense techniques promoted all week long. From building a logging architecture, augmenting logs, analyzing network logs, analyzing system logs, and developing dashboards to find attacks, this challenging exercise will reinforce key principles in a fun, hands-on, team-based challenge.

CPE/CMU Credits: 6

Topics

Defend-the-Flag Challenge - Hands-on Experience

Additional Information

Laptop Required

!! IMPORTANT - BRING YOUR OWN LAPTOP CONFIGURED USING THESE DIRECTIONS!!

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system that also can install and run VMware virtualization products. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install VMware Workstation 11, VMware Fusion 7, or VMware Workstation Player 7 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.

MANDATORY SEC555 SYSTEM REQUIREMENTS:

CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Wired Ethernet port (or adapter)

Wireless Ethernet 802.11 B/G/N/AC

USB 3.0 Ports Highly Recommended

Disk: 25 Gigabytes of free disk space

VMware Workstation 11, Workstation Player 7, or Fusion 7 (or newer)

A Linux virtual machine will be provided in class

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Who Should Attend

Security Analyst

Security Architects

Senior Security Engineers

Technical Security Managers

SOC Analysts

SOC Engineers

SOC Managers

CND Analysts

Security Monitoring

System Administrators

Cyber Threat Investigators

Individuals working to implement Continuous Security Monitoring or Network

Individuals working in a hunt team capacity

Prerequisites

A basic understanding of TCP/IP, logging methods and techniques, and general operating system fundamentals. Moderate familiarization with logging systems (both network and host), messaging queues, be accustomed to command-line activity, and commercial/open source SIEM solutions is a bonus.

Hands-on Training

SEC555 reinforces knowledge transfer by having many hands-on labs. This goes well beyond the traditional lecture and delves into literal application of techniques. Labs are wide ranging such as:

Log collection labs

Log augmentation labs

Log correlation labs

Windows log analysis labs

System and network baseline labs

Daily Immersive Cyber Challenges (NetWars game engine)

NetWars-based Final Capstone

The SEC555 Workbook provides a step by step guide to learning and applying hands on techniques but also provides a "challenge yourself" approach for those who want to stretch their skills and see how far they can get without following the guide. This allows students of varying backgrounds to pick a difficulty and always have a frustration free fallback path.

To make learning go from great to awesome days one through five include a SEC555 custom NetWars experience. This game engine provides a fun and entertaining way to reinforce skills and learn concepts. It also provides a fun excuse to give students more hands on experience, a key component often missing in organizations.

Author Statement

Today, security operations do not suffer from a "Big Data" problem but rather a "Data Analysis" problem. Let's face it, there are multiple ways to store and process large amounts of data without any real emphasis on gaining insight into the information collected. Added to that is the daunting idea of an infinite list of systems from which one could collect logs and it is easy to get lost in the perils of data saturation. This class is the switch from the typical churn and burn log systems to achieving actionable intelligence and developing a tactical Security Operations Center (SOC).

- Justin Henderson

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.